The attorneys general of Florida, Iowa, Montana and Nebraska have filed a lawsuit against TP-Link Systems Inc., alleging the router maker misled consumers about security and concealed its ties to China. The suit was filed on October 7.
Texas sued TP-Link separately earlier in 2026. TP-Link calls the claims baseless and says it intends to contest the suits.
What the States Allege Against TP-Link
The states put forward several claims. They say TP-Link made misleading statements about its products, including a “100 percent safeguard” claim for its HomeShield service. They also allege the company concealed ongoing ties to China and relies on Chinese components in its supply chain.
A further allegation is that TP-Link routers have shown repeated firmware flaws that state-backed hackers have exploited.
The Link to Volt Typhoon and Flax Typhoon
TP-Link routers were used in the Volt Typhoon and Flax Typhoon campaigns, according to the reporting on the suit. These are the state-backed hacking operations that the states point to when alleging the firmware flaws were exploited.
TP-Link’s Response
TP-Link says the claims are baseless. The company says it does not share customer network data with foreign governments, and it says the devices sold in the US are made in Vietnam. It intends to fight the lawsuits.
The company’s reply addresses two of the states’ themes directly, the question of data going to governments and the question of where the devices are built. The reporting does not describe TP-Link’s response to the allegation about the HomeShield claim.
Under the allegations, the combination of those claims forms the core of the consumer-protection case: that TP-Link described its security in absolute terms while allegedly hiding ties to China and shipping products with recurring firmware weaknesses. Florida, Iowa, Montana and Nebraska filed together, which pools the states’ resources against the same defendant.
Market Position
TP-Link held about 36.6 percent of US router unit sales in 2024, which makes it the largest US consumer router vendor by that measure. The size of its share is what gives the allegations their reach, since the products at issue sit in a large number of homes and small businesses.
The Wider Regulatory Backdrop
The state suits arrive after federal action. The FCC restricted new foreign-produced router models in March 2026. The state filings and the federal restriction both treat router origin and supply chain as a consumer-protection and security matter.
Texas filing a separate suit earlier in the year means five states are now pursuing TP-Link in total, counting the four in the new case and Texas. The reporting does not say whether the cases will be coordinated.
Legal and Market Pressure
The suits add legal and market pressure on the largest US consumer router vendor. Beyond any penalties, the cases put TP-Link’s marketing statements and its supply-chain disclosures under court scrutiny, and TP-Link will need to defend its claims about where its products are made and how it handles customer data.
TP-Link’s statement that its US devices are made in Vietnam responds to the supply-chain allegation, though the states’ complaint also points to reliance on Chinese components, which is a separate question from the country of final assembly. The reporting on the suit does not say which court the states chose or what penalties they seek.
The outcome will depend on proof of the states’ allegations, including whether the “100 percent safeguard” statement misled consumers and whether the firmware flaws and China ties are as alleged. No court has ruled on any of these questions. The allegations have not been proven, and TP-Link has said it will contest them.
The legal fight now moves into the courts of the participating states, with TP-Link’s stated denial on record from the outset.
